txt2stix 1.0.13__py3-none-any.whl → 1.1.0__py3-none-any.whl

txt2stix/bundler.py

@@ -10,6 +10,7 @@ from stix2 import (
 )
 from stix2.parsing import dict_to_stix2, parse as parse_stix
 from stix2.serialization import serialize
+from stix2validator.v21.shoulds import relationships_strict
 import hashlib
 from stix2 import (
     v21,
@@ -226,7 +227,7 @@ class txt2stixBundler:
                     "external_id": self.uuid,
                 },
                 {
-                    "source_name": "txt2stix Report MD5",
+                    "source_name": "txt2stix_report_md5",
                     "description": self.report_md5,
                 },
             ] + external_references,
@@ -359,13 +360,15 @@ class txt2stixBundler:
         ))
 
     def new_relationship(self, source_ref, target_ref, relationship_type, description=None, external_references=None):
-        return Relationship(
+        relationship = dict(
             id="relationship--"
             + str(
                 uuid.uuid5(
                     UUID_NAMESPACE, f"{relationship_type}+{source_ref}+{target_ref}"
                 )
             ),
+            type='relationship',
+            spec_version='2.1',
             source_ref=source_ref,
             target_ref=target_ref,
             relationship_type=relationship_type,
@@ -374,7 +377,6 @@ class txt2stixBundler:
             description=description,
             modified=self.report.modified,
             object_marking_refs=self.report.object_marking_refs,
-            allow_custom=True,
             external_references=external_references or [
                 {
                     "source_name": "txt2stix_report_id",
@@ -382,6 +384,12 @@ class txt2stixBundler:
                 }
             ],
         )
+        try:
+            relationships_strict(relationship)
+        except Exception as e:
+            relationship['relationship_type'] = 'related-to'
+            logger.debug(e)
+        return parse_stix(relationship, allow_custom=True)
 
     def to_json(self):
         return serialize(self.bundle, indent=4)
@@ -396,9 +404,10 @@ class txt2stixBundler:
                 self.add_indicator(ex, add_standard_relationship)
             except BaseException as e:
                 logger.debug(
-                    f"ran into exception while processing observable `{ex}`",
-                    stack_info=True,
+                    f"ran into exception while processing observable `{ex}`. {e}",
+                    exc_info=True,
                 )
+                ex['error'] = str(e)
 
     def process_relationships(self, observables):
         for relationship in observables:
@@ -416,38 +425,15 @@ class txt2stixBundler:
         )
 
     def add_summary(self, summary, ai_summary_provider):
-        self.summary = summary
-        summary_note_obj = Note(
-            type="note",
-            spec_version="2.1",
-            id=self.report.id.replace("report", "note"),
-            created=self.report.created,
-            modified=self.report.modified,
-            created_by_ref=self.report.created_by_ref,
-            external_references=[
-                {
-                    "source_name": "txt2stix_ai_summary_provider",
-                    "external_id": ai_summary_provider,
-                },
-            ],
-            abstract=f"AI Summary: {self.report.name}",
-            content=summary,
-            object_refs=[self.report.id],
-            object_marking_refs=self.report.object_marking_refs,
-            labels=self.report.get('labels'),
-            confidence=self.report.get('confidence')
-        )
-
-        self.add_ref(summary_note_obj)
-        self.add_ref(
-            self.new_relationship(
-                summary_note_obj["id"],
-                self.report.id,
-                relationship_type="summary-of",
-                description=f"AI generated summary for {self.report.name}",
-                external_references=summary_note_obj["external_references"],
+        self.report.external_references.append(
+            dict(
+                source_name='txt2stix_ai_summary',
+                external_id=ai_summary_provider,
+                description=summary
             )
         )
+        self.summary = summary
+
 
     @property
     def flow_objects(self):

txt2stix/indicator.py

@@ -24,7 +24,7 @@ if TYPE_CHECKING:
 
 from .common import MinorException
 
-from .retriever import retrieve_stix_objects
+from .retriever import _retrieve_stix_objects, retrieve_stix_objects
 
 logger = logging.getLogger("txt2stix.indicator")
 
@@ -93,7 +93,7 @@ def build_observables(
     except BadDataException:
         raise
     except BaseException as e:
-        raise BadDataException("unknown data error") from e
+        raise BadDataException(f"unknown data error: {e}") from e
 
 
 def _build_observables(
@@ -102,13 +102,6 @@ def _build_observables(
     retrieved_objects = retrieve_stix_objects(stix_mapping, extracted_value)
     if retrieved_objects:
         return retrieved_objects, [sdo["id"] for sdo in retrieved_objects]
-    if retrieved_objects == []:
-        logger.warning(
-            f"could not find `{stix_mapping}` with id=`{extracted_value}` in remote"
-        )
-        raise BadDataException(
-            f"could not find `{stix_mapping}` with id=`{extracted_value}` in remote"
-        )
 
     stix_objects = [indicator]
 
@@ -124,10 +117,10 @@ def _build_observables(
 
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{stix_objects[1]['value']} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {stix_objects[1]['value']}",
                 external_references=indicator["external_references"],
             )
         )
@@ -145,10 +138,10 @@ def _build_observables(
         id = stix_objects[-1].id
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{stix_objects[1]['value']} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {stix_objects[1]['value']}",
             )
         )
 
@@ -175,10 +168,10 @@ def _build_observables(
         )
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{stix_objects[1]['value']} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {stix_objects[1]['value']}",
                 external_references=indicator["external_references"],
             )
         )
@@ -196,10 +189,10 @@ def _build_observables(
         id = stix_objects[-1].id
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{stix_objects[1]['value']} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {stix_objects[1]['value']}",
                 external_references=indicator["external_references"],
             )
         )
@@ -236,10 +229,10 @@ def _build_observables(
         )
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -258,10 +251,10 @@ def _build_observables(
         )
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -270,6 +263,8 @@ def _build_observables(
     if stix_mapping in ["file", "directory-file"]:
         if not mimetype:
             raise BadDataException(f"invalid file extension in `{extracted_value}`")
+
+    if stix_mapping == "file":
         file = dict_to_stix2(
             {
                 "type": "file",
@@ -278,18 +273,16 @@ def _build_observables(
                 "mime_type": mimetype,
             }
         )
-
-    if stix_mapping == "file":
         indicator["name"] = f"File name: {extracted_value}"
         indicator["pattern"] = f"[ file:name = { repr(extracted_value) } ]"
 
         stix_objects.append(file)
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -305,46 +298,43 @@ def _build_observables(
         )
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
 
     if stix_mapping == "directory-file":
         path = parse_path(extracted_value)
-        extracted_value = str(path.parent)
-        indicator["name"] = f"Directory: {extracted_value}"
-        indicator["pattern"] = f"[ directory:path = { repr(extracted_value) } ]"
-
         dir_obj = dict_to_stix2(
-            {"type": "directory", "spec_version": "2.1", "path": extracted_value}
+            {"type": "directory", "spec_version": "2.1", "path": str(path.parent)}
         )
-        stix_objects.append(dir_obj)
-        dir = stix_objects[-1]
-        stix_objects.append(
-            bundler.new_relationship(
-                stix_objects[1].id,
-                indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
-                external_references=indicator["external_references"],
-            )
+        file = dict_to_stix2(
+            {
+                "type": "file",
+                "spec_version": "2.1",
+                "name": path.name,
+                "mime_type": mimetype,
+                "parent_directory_ref": dir_obj.id,
+            }
         )
+        indicator["name"] = f"Directory File: {extracted_value}"
+        indicator["pattern"] = f"[ directory:path = { repr(dir_obj.path) }  OR file:name = {repr(file.name)}]"
 
+        stix_objects.append(dir_obj)
         stix_objects.append(file)
         stix_objects.append(
             bundler.new_relationship(
+                indicator["id"],
                 file.id,
-                dir.id,
-                "directory",
-                description=f"{extracted_value} directory {indicator['name']}",
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
-        return stix_objects, [dir_obj.id]
+        return stix_objects, [file.id]
 
     if stix_mapping == "file-hash":
         file_hash_type = (
@@ -369,10 +359,10 @@ def _build_observables(
         )
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -391,10 +381,10 @@ def _build_observables(
         )
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -413,10 +403,10 @@ def _build_observables(
         )
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -440,10 +430,10 @@ def _build_observables(
         )
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -459,10 +449,10 @@ def _build_observables(
         )
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -491,10 +481,10 @@ def _build_observables(
         )
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -517,10 +507,10 @@ def _build_observables(
         stix_objects.extend(other_objects)
         stix_objects.append(
             bundler.new_relationship(
-                wallet_obj.id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                wallet_obj.id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -541,10 +531,10 @@ def _build_observables(
         stix_objects.extend(other_objects)
         stix_objects.append(
             bundler.new_relationship(
-                txn_object.id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                txn_object.id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -569,10 +559,10 @@ def _build_observables(
         stix_objects.extend(other_objects)
         stix_objects.append(
             bundler.new_relationship(
-                wallet_obj.id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                wallet_obj.id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -599,10 +589,10 @@ def _build_observables(
 
         stix_objects.append(
             bundler.new_relationship(
-                card_object["id"],
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                card_object["id"],
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -632,10 +622,10 @@ def _build_observables(
         )
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )
@@ -662,10 +652,10 @@ def _build_observables(
         )
         stix_objects.append(
             bundler.new_relationship(
-                stix_objects[1].id,
                 indicator["id"],
-                "detected-using",
-                description=f"{extracted_value} can be detected in the STIX pattern {indicator['name']}",
+                stix_objects[1].id,
+                "related-to",
+                description=f"STIX pattern contains {extracted_value}",
                 external_references=indicator["external_references"],
             )
         )

txt2stix/retriever.py

@@ -4,55 +4,77 @@ import dotenv, os
 import stix2
 import requests
 
+from txt2stix.common import MinorException
+
 dotenv.load_dotenv()
 
 
+class UnsupportedRemoteExtraction(MinorException):
+    pass
+
+
 class STIXObjectRetriever:
     def __init__(self, host="ctibutler") -> None:
         if host == "ctibutler":
-            self.api_root = os.environ['CTIBUTLER_BASE_URL'] + '/'
-            self.api_key = os.environ.get('CTIBUTLER_API_KEY')
+            self.api_root = os.environ["CTIBUTLER_BASE_URL"] + "/"
+            self.api_key = os.environ.get("CTIBUTLER_API_KEY")
         elif host == "vulmatch":
-            self.api_root = os.environ['VULMATCH_BASE_URL'] + '/'
-            self.api_key = os.environ.get('VULMATCH_API_KEY')
+            self.api_root = os.environ["VULMATCH_BASE_URL"] + "/"
+            self.api_key = os.environ.get("VULMATCH_API_KEY")
         else:
-            raise NotImplementedError("The type `%s` is not supported", host)
+            raise UnsupportedRemoteExtraction("The type `%s` is not supported", host)
+
         self.session = requests.Session()
-        self.session.headers.update({
-            "API-KEY":  self.api_key,
-        })
+        self.session.headers.update(
+            {
+                "API-KEY": self.api_key,
+            }
+        )
 
     def get_attack_object(self, matrix, attack_id):
         endpoint = urljoin(self.api_root, f"v1/attack-{matrix}/objects/{attack_id}/")
         return self._retrieve_objects(endpoint)
-    
+
     def get_attack_tactics(self, matrix):
-        endpoint = urljoin(self.api_root, f"v1/attack-{matrix}/objects/?attack_type=Tactic")
-        version_url = urljoin(self.api_root, f'v1/attack-{matrix}/versions/installed/')
+        endpoint = urljoin(
+            self.api_root, f"v1/attack-{matrix}/objects/?attack_type=Tactic"
+        )
+        version_url = urljoin(self.api_root, f"v1/attack-{matrix}/versions/installed/")
         tactics = self._retrieve_objects(endpoint)
-        retval = dict(version=self.session.get(version_url).json()['latest'])
+        retval = dict(version=self.session.get(version_url).json()["latest"])
         for tac in tactics:
-            retval[tac['x_mitre_shortname']] = tac
-            retval[tac['external_references'][0]['external_id']] = tac
+            retval[tac["x_mitre_shortname"]] = tac
+            retval[tac["external_references"][0]["external_id"]] = tac
         return retval
-    
+
     def get_attack_objects(self, matrix, attack_ids):
-        endpoint = urljoin(self.api_root, f"v1/attack-{matrix}/objects/?attack_id={','.join(attack_ids)}")
+        endpoint = urljoin(
+            self.api_root,
+            f"v1/attack-{matrix}/objects/?attack_id={','.join(attack_ids)}",
+        )
         return self._retrieve_objects(endpoint)
-    
+
     def get_objects_by_id(self, id, type):
-        return self._retrieve_objects(urljoin(self.api_root, f"v1/{type}/objects/{id}/"))
-    
+        return self._retrieve_objects(
+            urljoin(self.api_root, f"v1/{type}/objects/{id}/")
+        )
+
     def get_location_objects(self, id):
-        return self._retrieve_objects(urljoin(self.api_root, f"v1/location/objects/?alpha2_code={id}"))
-    
+        return self._retrieve_objects(
+            urljoin(self.api_root, f"v1/location/objects/?alpha2_code={id}")
+        )
+
     def get_objects_by_name(self, name, type):
-        return self._retrieve_objects(urljoin(self.api_root, f"v1/{type}/objects/?name={name}"))
-    
+        return self._retrieve_objects(
+            urljoin(self.api_root, f"v1/{type}/objects/?name={name}")
+        )
+
     def get_objects_by_alias(self, alias, type):
-        return self._retrieve_objects(urljoin(self.api_root, f"v1/{type}/objects/?alias={alias}"))
-    
-    def _retrieve_objects(self, endpoint, key='objects'):
+        return self._retrieve_objects(
+            urljoin(self.api_root, f"v1/{type}/objects/?alias={alias}")
+        )
+
+    def _retrieve_objects(self, endpoint, key="objects"):
         data = []
         page = 1
         while True:
@@ -62,75 +84,82 @@ class STIXObjectRetriever:
             if len(d[key]) == 0:
                 break
             data.extend(d[key])
-            page+=1
-            if d['page_results_count'] < d['page_size']:
+            page += 1
+            if d["page_results_count"] < d["page_size"]:
                 break
         return data
-    
-def retrieve_stix_objects(stix_mapping: str, id, host=None):
+
+
+def _retrieve_stix_objects(host, knowledge_base, filter_value):
+    retreiver = STIXObjectRetriever(host)
+    match knowledge_base:
+        ### ATT&CK by ID
+        case "mitre-attack-ics-id":
+            return retreiver.get_attack_object("ics", filter_value)
+        case "mitre-attack-mobile-id":
+            return retreiver.get_attack_object("mobile", filter_value)
+        case "mitre-attack-enterprise-id":
+            return retreiver.get_attack_object("enterprise", filter_value)
+
+        ### Others by ID
+        case "mitre-capec-id":
+            return retreiver.get_objects_by_id(filter_value, "capec")
+        case "mitre-atlas-id":
+            return retreiver.get_objects_by_id(filter_value, "atlas")
+        case "disarm-id":
+            return retreiver.get_objects_by_id(filter_value, "disarm")
+        case "mitre-cwe-id":
+            return retreiver.get_objects_by_id(filter_value, "cwe")
+        case "cve-id":
+            return retreiver.get_objects_by_id(filter_value, "cve")
+        case "cpe-id":
+            return retreiver.get_objects_by_id(filter_value, "cpe")
+        case "location":
+            return retreiver.get_location_objects(filter_value)
+
+        ### ATT&CK by Name
+        case "mitre-attack-enterprise-name":
+            return retreiver.get_objects_by_name(filter_value, "attack-enterprise")
+        case "mitre-attack-mobile-name":
+            return retreiver.get_objects_by_name(filter_value, "attack-mobile")
+        case "mitre-attack-ics-name":
+            return retreiver.get_objects_by_name(filter_value, "attack-ics")
+
+        ### ATT&CK by Alias
+        case "mitre-attack-enterprise-aliases":
+            return retreiver.get_objects_by_alias(filter_value, "attack-enterprise")
+        case "mitre-attack-mobile-aliases":
+            return retreiver.get_objects_by_alias(filter_value, "attack-mobile")
+        case "mitre-attack-ics-aliases":
+            return retreiver.get_objects_by_alias(filter_value, "attack-ics")
+
+        ### OTHERS by Name
+        case "mitre-capec-name":
+            return retreiver.get_objects_by_name(filter_value, "capec")
+        case "mitre-cwe-name":
+            return retreiver.get_objects_by_name(filter_value, "cwe")
+        case "mitre-atlas-name":
+            return retreiver.get_objects_by_name(filter_value, "atlas")
+        case "disarm-name":
+            return retreiver.get_objects_by_name(filter_value, "disarm")
+        case _:
+            raise UnsupportedRemoteExtraction(
+                f"pair {(host, knowledge_base)=} not implemented"
+            )
+
+
+def retrieve_stix_objects(stix_mapping: str, filter_value, host=None):
+    knowledge_base = stix_mapping
+    if stix_mapping in ["location"]:
+        host = "ctibutler"
+    if not host:
+        host, _, knowledge_base = stix_mapping.partition("-")
     try:
-        object_path = stix_mapping
-        if stix_mapping in ['location']:
-            host = 'ctibutler'
-        if not host:
-            host, object_path = stix_mapping.split('-', 1)
-        retreiver = STIXObjectRetriever(host)
-        match object_path:
-            ### ATT&CK by ID
-            case 'mitre-attack-ics-id':
-                return retreiver.get_attack_object('ics', id)
-            case 'mitre-attack-mobile-id':
-                return retreiver.get_attack_object('mobile', id)
-            case 'mitre-attack-enterprise-id':
-                return retreiver.get_attack_object('enterprise', id)
-            
-            ### Others by ID
-            case "mitre-capec-id":
-                return retreiver.get_objects_by_id(id, 'capec')
-            case "mitre-atlas-id":
-                return retreiver.get_objects_by_id(id, 'atlas')
-            case "disarm-id":
-                return retreiver.get_objects_by_id(id, 'disarm')
-            case "mitre-cwe-id":
-                return retreiver.get_objects_by_id(id, 'cwe')
-            case "cve-id":
-                return retreiver.get_objects_by_id(id, 'cve')
-            case "cpe-id":
-                return retreiver.get_objects_by_id(id, 'cpe')
-            case "location":
-                return retreiver.get_location_objects(id)
-            
-            ### ATT&CK by Name
-            case "mitre-attack-enterprise-name":
-                return retreiver.get_objects_by_name(id, 'attack-enterprise')
-            case "mitre-attack-mobile-name":
-                return retreiver.get_objects_by_name(id, 'attack-mobile')
-            case "mitre-attack-ics-name":
-                return retreiver.get_objects_by_name(id, 'attack-ics')
-            
-            ### ATT&CK by Alias
-            case "mitre-attack-enterprise-aliases":
-                return retreiver.get_objects_by_alias(id, 'attack-enterprise')
-            case "mitre-attack-mobile-aliases":
-                return retreiver.get_objects_by_alias(id, 'attack-mobile')
-            case "mitre-attack-ics-aliases":
-                return retreiver.get_objects_by_alias(id, 'attack-ics')
-            
-            ### OTHERS by Name
-            case "mitre-capec-name":
-                return retreiver.get_objects_by_name(id, 'capec')
-            case "mitre-cwe-name":
-                return retreiver.get_objects_by_name(id, 'cwe')
-            case "mitre-atlas-name":
-                return retreiver.get_objects_by_name(id, 'atlas')
-            case "disarm-name":
-                return retreiver.get_objects_by_name(id, 'disarm')
-            case _:
-                raise NotImplementedError(f"pair {(host, object_path)=} not implemented")
-    except (NotImplementedError, ValueError):
-        pass
-    except Exception as e:
-        msg = f"failed to get {object_path} for {id} from {host}"
-        logging.info(msg)
-        logging.debug(msg, exc_info=True)
-    return None
+        objects = _retrieve_stix_objects(host, knowledge_base, filter_value)
+        if not objects:
+            raise MinorException(f"{host} returned no data")
+        if len(objects)> 15:
+            raise MinorException(f"{host} returned too much data ({len(objects)})")
+        return objects
+    except UnsupportedRemoteExtraction:
+        return None

txt2stix/txt2stix.py

@@ -394,7 +394,7 @@ def run_txt2stix(bundler: txt2stixBundler, preprocessed_text: str, extractors_ma
         logging.info("=== ai-check-content output ====")
         logging.info(retval.content_check.model_dump_json())
         for classification in retval.content_check.incident_classification:
-            bundler.report.labels.append(f'txt2stix:{classification}'.lower())
+            bundler.report.labels.append(f'classification.{classification}'.lower())
         bundler.add_summary(retval.content_check.summary, model.extractor_name)
 
     if should_extract or ai_extract_if_no_incidence:

{txt2stix-1.0.13.dist-info → txt2stix-1.1.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: txt2stix
-Version: 1.0.13
+Version: 1.1.0
 Summary: txt2stix is a Python script that is designed to identify and extract IoCs and TTPs from text files, identify the relationships between them, convert them to STIX 2.1 objects, and output as a STIX 2.1 bundle.
 Project-URL: Homepage, https://github.com/muchdogesec/txt2stix
 Project-URL: Issues, https://github.com/muchdogesec/txt2stix/issues
@@ -22,6 +22,7 @@ Requires-Dist: phonenumbers>=8.13.39
 Requires-Dist: python-dotenv>=1.0.1
 Requires-Dist: requests>=2.32.4
 Requires-Dist: schwifty>=2024.6.1
+Requires-Dist: stix2-validator
 Requires-Dist: stix2extensions
 Requires-Dist: tld>=0.13
 Requires-Dist: tldextract>=5.1.2

{txt2stix-1.0.13.dist-info → txt2stix-1.1.0.dist-info}/RECORD

@@ -1,14 +1,14 @@
 txt2stix/__init__.py,sha256=Sm_VT913IFuAZ6dJEdVz3baPwC5VYtHySVfBAOUG92w,803
 txt2stix/attack_flow.py,sha256=FA5mRf4iVe9E6e_WfGF9PK6MTz8f3UhvDKjO_PDFHso,9164
-txt2stix/bundler.py,sha256=kqUNW9_jktuMyWSkoAa-ydZY-L5gzSSkthb7OdhUiKo,16854
+txt2stix/bundler.py,sha256=TLGvi19mPiAVwz4434PcyPiO_FGFFo35hQvcJoNQrN4,16264
 txt2stix/common.py,sha256=ISnGNKqJPE1EcfhL-x_4G18mcwt1urmorkW-ru9kV-0,585
 txt2stix/credential_checker.py,sha256=eWDP-jY3-jm8zI0JMoUcyoQZ_JqPNfCIr_HAO8nVYz0,3044
 txt2stix/extractions.py,sha256=_tlsqYHhfAoV-PJzxRHysrX47uxCsMlSg7PQWxww1u0,2171
-txt2stix/indicator.py,sha256=c6S0xx0K8JM-PT_Qd1PlN_ZlDXdnEwiRS8529iUp3yg,30774
+txt2stix/indicator.py,sha256=lukbmRMrRTKvirs_BnIOoAcmRIdyqkodJGDmQE_D6YE,29621
 txt2stix/lookups.py,sha256=h42YVtYUkWZm6ZPv2h5hHDHDzDs3yBqrT_T7pj2MDZI,2301
-txt2stix/retriever.py,sha256=biRSRwYsZoSvR758y4OFONjfrEMcxgj1PLHFLFydoSU,5729
+txt2stix/retriever.py,sha256=cOcC6h-eyutfdIFQqAPUodneBFwgk21q0u2rXI9L57Q,6177
 txt2stix/stix.py,sha256=9nXD9a2dCY4uaatl-mlIA1k3srwQBhGW-tUSho3iYe0,30
-txt2stix/txt2stix.py,sha256=Y7vr4zzh8PvFCD-pX8-qm8kxuintjkhnqQ-OYfq7CRs,18589
+txt2stix/txt2stix.py,sha256=4iVvzlLbUeDIKUPPHGUWZufsy-LIMPk6ejrw8kSI1o8,18595
 txt2stix/utils.py,sha256=n6mh4t9ZRJ7iT4Jvp9ai_dfCXjgXNcRtF_zXO7nkpnk,3304
 txt2stix/ai_extractor/__init__.py,sha256=5Tf6Co9THzytBdFEVhD-7vvT05TT3nSpltnAV1sfdoM,349
 txt2stix/ai_extractor/anthropic.py,sha256=mdz-8CB-BSCEqnK5l35DRZURVPUf508ef2b48XMxmuk,441
@@ -113,8 +113,8 @@ txt2stix/includes/lookups/threat_actor.txt,sha256=QfDO9maQuqKBgW_Sdd7VGv1SHZ9Ra-
 txt2stix/includes/lookups/tld.txt,sha256=-MEgJea2NMG_KDsnc4BVvI8eRk5Dm93L-t8SGYx5wMo,8598
 txt2stix/includes/lookups/tool.txt,sha256=HGKG6JpUE26w6ezzSxOjBkp15UpSaB7N-mZ_NU_3G7A,6
 txt2stix/includes/tests/test_cases.yaml,sha256=QD1FdIunpPkOpsn6wJRqs2vil_hv8OSVaqUp4a96aZg,22247
-txt2stix-1.0.13.dist-info/METADATA,sha256=pzYsUzHCP45Ab_8MWy0slJzmFiXzNeiVg49Z53lMDG8,15483
-txt2stix-1.0.13.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-txt2stix-1.0.13.dist-info/entry_points.txt,sha256=x6QPtt65hWeomw4IpJ_wQUesBl1M4WOLODbhOKyWMFg,55
-txt2stix-1.0.13.dist-info/licenses/LICENSE,sha256=BK8Ppqlc4pdgnNzIxnxde0taoQ1BgicdyqmBvMiNYgY,11364
-txt2stix-1.0.13.dist-info/RECORD,,
+txt2stix-1.1.0.dist-info/METADATA,sha256=gnYa1a2OgArD_OllpkEDC78bQjaY4bevDONJCP7vmm4,15513
+txt2stix-1.1.0.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+txt2stix-1.1.0.dist-info/entry_points.txt,sha256=x6QPtt65hWeomw4IpJ_wQUesBl1M4WOLODbhOKyWMFg,55
+txt2stix-1.1.0.dist-info/licenses/LICENSE,sha256=BK8Ppqlc4pdgnNzIxnxde0taoQ1BgicdyqmBvMiNYgY,11364
+txt2stix-1.1.0.dist-info/RECORD,,